Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
H9NSZqE1YV

Overview

General Information

Sample Name:H9NSZqE1YV
Analysis ID:679633
MD5:58836131abfd4884cee3a45e82344236
SHA1:99834e69d8788d276f63ee5968256cb84d3dc1c4
SHA256:75197b35b16d2668bf3c9437ac9e29f2287db5b1f0839acc4f6dbcf7bca02ae2
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679633
Start date and time: 06/08/202207:40:132022-08-06 07:40:13 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 38s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:H9NSZqE1YV
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal76.troj.lin@0/0@42/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/H9NSZqE1YV
PID:6232
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • H9NSZqE1YV (PID: 6232, Parent: 6124, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/H9NSZqE1YV
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
H9NSZqE1YVJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6232.1.00007fc154001000.00007fc154016000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6331.1.00007fc154001000.00007fc154016000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6244.1.00007fc154001000.00007fc154016000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: H9NSZqE1YVAvira: detected
            Multi AV Scanner detection for submitted file
            Source: H9NSZqE1YVVirustotal: Detection: 50%Perma Link
            Source: H9NSZqE1YVMetadefender: Detection: 31%Perma Link
            Source: H9NSZqE1YVReversingLabs: Detection: 61%

            Networking

            barindex
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38848
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38856
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38874
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38876
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38878
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38888
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38892
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38894
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38896
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38900
            Source: global trafficTCP traffic: 192.168.2.23:49684 -> 189.236.48.74:7547
            Source: global trafficTCP traffic: 192.168.2.23:33416 -> 112.170.93.137:7547
            Source: global trafficTCP traffic: 192.168.2.23:53436 -> 46.23.109.40:1312
            Source: /tmp/H9NSZqE1YV (PID: 6232)Socket: 127.0.0.1::1312
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::0
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::23
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::53413
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::80
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::52869
            Source: /tmp/H9NSZqE1YV (PID: 6242)Socket: 0.0.0.0::37215
            Source: unknownDNS traffic detected: queries for: arcticboatz.cz
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 2808
            Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
            Source: unknownTCP traffic detected without corresponding DNS query: 189.236.48.74
            Source: unknownTCP traffic detected without corresponding DNS query: 112.170.93.137
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
            Source: unknownTCP traffic detected without corresponding DNS query: 189.236.48.74
            Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
            Source: unknownTCP traffic detected without corresponding DNS query: 158.209.73.34
            Source: unknownTCP traffic detected without corresponding DNS query: 79.230.189.239
            Source: unknownTCP traffic detected without corresponding DNS query: 40.71.205.34
            Source: unknownTCP traffic detected without corresponding DNS query: 255.240.206.49
            Source: unknownTCP traffic detected without corresponding DNS query: 146.74.47.18
            Source: unknownTCP traffic detected without corresponding DNS query: 78.218.165.73
            Source: unknownTCP traffic detected without corresponding DNS query: 244.16.155.19
            Source: unknownTCP traffic detected without corresponding DNS query: 129.8.7.47
            Source: unknownTCP traffic detected without corresponding DNS query: 216.253.109.206
            Source: unknownTCP traffic detected without corresponding DNS query: 44.139.232.96
            Source: unknownTCP traffic detected without corresponding DNS query: 23.21.46.22
            Source: unknownTCP traffic detected without corresponding DNS query: 191.197.164.163
            Source: unknownTCP traffic detected without corresponding DNS query: 126.178.56.153
            Source: unknownTCP traffic detected without corresponding DNS query: 117.53.114.23
            Source: unknownTCP traffic detected without corresponding DNS query: 173.7.147.254
            Source: unknownTCP traffic detected without corresponding DNS query: 170.51.199.30
            Source: unknownTCP traffic detected without corresponding DNS query: 206.243.187.98
            Source: unknownTCP traffic detected without corresponding DNS query: 9.38.164.129
            Source: unknownTCP traffic detected without corresponding DNS query: 75.86.70.161
            Source: unknownTCP traffic detected without corresponding DNS query: 57.243.157.111
            Source: unknownTCP traffic detected without corresponding DNS query: 31.205.83.49
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.20.237
            Source: unknownTCP traffic detected without corresponding DNS query: 12.120.176.124
            Source: unknownTCP traffic detected without corresponding DNS query: 79.49.199.46
            Source: unknownTCP traffic detected without corresponding DNS query: 59.62.201.167
            Source: unknownTCP traffic detected without corresponding DNS query: 246.239.56.178
            Source: unknownTCP traffic detected without corresponding DNS query: 17.240.180.52
            Source: unknownTCP traffic detected without corresponding DNS query: 206.46.174.77
            Source: unknownTCP traffic detected without corresponding DNS query: 92.35.25.14
            Source: unknownTCP traffic detected without corresponding DNS query: 155.65.48.135
            Source: unknownTCP traffic detected without corresponding DNS query: 9.152.178.21
            Source: unknownTCP traffic detected without corresponding DNS query: 18.32.189.2
            Source: unknownTCP traffic detected without corresponding DNS query: 192.8.195.30
            Source: unknownTCP traffic detected without corresponding DNS query: 242.39.196.246
            Source: unknownTCP traffic detected without corresponding DNS query: 126.101.119.208
            Source: unknownTCP traffic detected without corresponding DNS query: 154.238.65.57
            Source: unknownTCP traffic detected without corresponding DNS query: 250.83.50.223
            Source: unknownTCP traffic detected without corresponding DNS query: 141.191.30.241
            Source: unknownTCP traffic detected without corresponding DNS query: 177.61.206.106
            Source: unknownTCP traffic detected without corresponding DNS query: 126.231.7.36
            Source: unknownTCP traffic detected without corresponding DNS query: 222.21.186.251
            Source: unknownTCP traffic detected without corresponding DNS query: 166.252.138.130
            Source: unknownTCP traffic detected without corresponding DNS query: 98.238.12.183
            Source: unknownTCP traffic detected without corresponding DNS query: 95.108.120.160
            Source: unknownTCP traffic detected without corresponding DNS query: 240.255.179.116
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: /tmp/H9NSZqE1YV (PID: 6242)SIGKILL sent: pid: 936, result: successful
            Source: Initial sampleString containing 'busybox' found: /bin/busybox AK1K2
            Source: Initial sampleString containing 'busybox' found: /bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
            Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
            Source: Initial sampleString containing 'busybox' found: >%st && cd %s && >retrieve; >.t/bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
            Source: Initial sampleString containing 'busybox' found: >>>/bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
            Source: classification engineClassification label: mal76.troj.lin@0/0@42/0
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/491/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/793/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/772/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/796/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/774/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/797/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/777/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/799/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/658/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/912/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/759/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/936/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/918/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/1/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/761/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/785/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/884/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/720/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/721/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/788/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/789/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/800/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/801/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/847/fd
            Source: /tmp/H9NSZqE1YV (PID: 6242)File opened: /proc/904/fd

            Hooking and other Techniques for Hiding and Protection

            barindex
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38848
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38856
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38874
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38876
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38878
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38888
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38892
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38894
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38896
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38900
            Source: /tmp/H9NSZqE1YV (PID: 6232)Queries kernel information via 'uname':
            Source: H9NSZqE1YV, 6232.1.000055d88c945000.000055d88c9f5000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
            Source: H9NSZqE1YV, 6331.1.000055d88c945000.000055d88c9f5000.rw-.sdmp, H9NSZqE1YV, 6244.1.000055d88c945000.000055d88c9f5000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
            Source: H9NSZqE1YV, 6232.1.000055d88c945000.000055d88c9f5000.rw-.sdmp, H9NSZqE1YV, 6331.1.000055d88c945000.000055d88c9f5000.rw-.sdmp, H9NSZqE1YV, 6244.1.000055d88c945000.000055d88c9f5000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
            Source: H9NSZqE1YV, 6232.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmp, H9NSZqE1YV, 6331.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmp, H9NSZqE1YV, 6244.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/H9NSZqE1YVSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/H9NSZqE1YV
            Source: H9NSZqE1YV, 6232.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmp, H9NSZqE1YV, 6331.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmp, H9NSZqE1YV, 6244.1.00007ffd979ef000.00007ffd97a10000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

            Stealing of Sensitive Information

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: H9NSZqE1YV, type: SAMPLE
            Source: Yara matchFile source: 6232.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6331.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: H9NSZqE1YV, type: SAMPLE
            Source: Yara matchFile source: 6232.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6331.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007fc154001000.00007fc154016000.r-x.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
            OS Credential Dumping            		11
            Security Software Discovery            		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
            Encrypted Channel            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
            Non-Standard Port            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
            Non-Application Layer Protocol            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer2
            Application Layer Protocol            		SIM Card SwapCarrier Billing Fraud

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679633 Sample: H9NSZqE1YV Startdate: 06/08/2022 Architecture: LINUX Score: 76 25 arcticboatz.cz 2->25 27 156.104.246.46 XNSTGCA United States 2->27 29 99 other IPs or domains 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected Mirai 2->35 37 Uses known network protocols on non-standard ports 2->37 9 H9NSZqE1YV 2->9         started        signatures3 process4 process5 11 H9NSZqE1YV 9->11         started        13 H9NSZqE1YV 9->13         started        15 H9NSZqE1YV 9->15         started        17 H9NSZqE1YV 9->17         started        process6 19 H9NSZqE1YV 11->19         started        21 H9NSZqE1YV 11->21         started        process7 23 H9NSZqE1YV 19->23         started       

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            H9NSZqE1YV50%VirustotalBrowse
            H9NSZqE1YV31%MetadefenderBrowse
            H9NSZqE1YV62%ReversingLabsLinux.Trojan.Mirai
            H9NSZqE1YV100%AviraLINUX/Mirai.ywooj

            Dropped Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            arcticboatz.cz12%VirustotalBrowse

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            arcticboatz.cz
            		46.23.109.40
            		truetrueunknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            155.109.221.154
            		unknownUnited States
            		10273FPLUSfalse
            181.135.48.207
            		unknownColombia
            		13489EPMTelecomunicacionesSAESPCOfalse
            14.165.112.96
            		unknownViet Nam
            		45899VNPT-AS-VNVNPTCorpVNfalse
            220.110.11.185
            		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
            118.48.135.48
            		unknownKorea Republic of
            		4766KIXS-AS-KRKoreaTelecomKRfalse
            223.89.203.166
            		unknownChina
            		24445CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCNfalse
            85.156.76.78
            		unknownFinland
            		719ELISA-ASHelsinkiFinlandEUfalse
            152.173.70.221
            		unknownChile
            		7418TELEFONICACHILESACLfalse
            218.158.128.63
            		unknownKorea Republic of
            		4766KIXS-AS-KRKoreaTelecomKRfalse
            62.201.85.237
            		unknownHungary
            		5483MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHUfalse
            17.62.173.148
            		unknownUnited States
            		714APPLE-ENGINEERINGUSfalse
            5.70.23.230
            		unknownUnited Kingdom
            		5607BSKYB-BROADBAND-ASGBfalse
            146.219.29.46
            		unknownSpain
            		16153SCS-ASESfalse
            247.47.97.152
            		unknownReserved
            		unknownunknownfalse
            194.130.165.150
            		unknownUnited Kingdom
            		702UUNETUSfalse
            179.67.232.125
            		unknownBrazil
            		7738TelemarNorteLesteSABRfalse
            46.81.13.66
            		unknownGermany
            		3320DTAGInternetserviceprovideroperationsDEfalse
            78.133.68.230
            		unknownMalta
            		15735DATASTREAM-NETMTfalse
            195.37.15.177
            		unknownGermany
            		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
            16.116.70.80
            		unknownUnited States
            		unknownunknownfalse
            93.213.34.200
            		unknownGermany
            		3320DTAGInternetserviceprovideroperationsDEfalse
            156.104.246.46
            		unknownUnited States
            		393504XNSTGCAfalse
            241.154.209.12
            		unknownReserved
            		unknownunknownfalse
            57.180.31.231
            		unknownBelgium
            		2686ATGS-MMD-ASUSfalse
            63.48.170.89
            		unknownUnited States
            		701UUNETUSfalse
            148.219.15.211
            		unknownMexico
            		8151UninetSAdeCVMXfalse
            65.0.13.224
            		unknownUnited States
            		16509AMAZON-02USfalse
            190.143.63.123
            		unknownColombia
            		10620TelmexColombiaSACOfalse
            19.247.181.236
            		unknownUnited States
            		3MIT-GATEWAYSUSfalse
            246.157.85.58
            		unknownReserved
            		unknownunknownfalse
            116.118.24.28
            		unknownViet Nam
            		7602SPT-AS-VNSaigonPostelCorporationVNfalse
            70.57.248.164
            		unknownUnited States
            		209CENTURYLINK-US-LEGACY-QWESTUSfalse
            110.153.118.192
            		unknownChina
            		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            176.224.224.196
            		unknownSaudi Arabia
            		35819MOBILY-ASEtihadEtisalatCompanyMobilySAfalse
            175.182.19.79
            		unknownTaiwan; Republic of China (ROC)
            		4780SEEDNETDigitalUnitedIncTWfalse
            78.123.223.255
            		unknownFrance
            		8228CEGETEL-ASFRfalse
            74.245.253.55
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            168.219.183.244
            		unknownKorea Republic of
            		6619SAMSUNGSDS-AS-KRSamsungSDSIncKRfalse
            133.121.206.53
            		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
            208.217.184.119
            		unknownUnited States
            		701UUNETUSfalse
            118.149.102.179
            		unknownNew Zealand
            		23655SNAP-NZ-ASSnapInternetLimitedNZfalse
            243.157.27.5
            		unknownReserved
            		unknownunknownfalse
            115.247.124.226
            		unknownIndia
            		55836RELIANCEJIO-INRelianceJioInfocommLimitedINfalse
            70.53.130.250
            		unknownCanada
            		577BACOMCAfalse
            101.230.221.215
            		unknownChina
            		4812CHINANET-SH-APChinaTelecomGroupCNfalse
            64.230.113.77
            		unknownCanada
            		577BACOMCAfalse
            54.120.7.252
            		unknownUnited States
            		16509AMAZON-02USfalse
            88.144.103.27
            		unknownUnited Kingdom
            		12708ONETEL-ASTalkTalkCommunicationsLimitedGBfalse
            202.147.239.4
            		unknownIndonesia
            		18156BITNET-ID-APBITNETISPASIDfalse
            222.226.32.24
            		unknownJapan2516KDDIKDDICORPORATIONJPfalse
            133.238.136.184
            		unknownJapan2497IIJInternetInitiativeJapanIncJPfalse
            171.129.35.104
            		unknownUnited States
            		9874STARHUB-MOBILEStarHubLtdSGfalse
            255.229.26.40
            		unknownReserved
            		unknownunknownfalse
            111.160.230.225
            		unknownChina
            		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            252.233.82.244
            		unknownReserved
            		unknownunknownfalse
            248.16.28.150
            		unknownReserved
            		unknownunknownfalse
            59.44.8.235
            		unknownChina
            		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            158.54.95.144
            		unknownAustralia
            		11757WHIRLPOOL-ASNUSfalse
            132.1.35.245
            		unknownUnited States
            		385AFCONC-BLOCK1-ASUSfalse
            5.112.38.239
            		unknownIran (ISLAMIC Republic Of)
            		44244IRANCELL-ASIRfalse
            146.0.120.110
            		unknownGermany
            		16097HLKOMM04107LeipzigDEfalse
            246.229.188.175
            		unknownReserved
            		unknownunknownfalse
            156.58.199.215
            		unknownAustria
            		199083MP-ASATfalse
            255.96.63.163
            		unknownReserved
            		unknownunknownfalse
            76.221.46.250
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            177.10.52.215
            		unknownBrazil
            		53232BannerServicosdeTelecomeInternetLtdaBRfalse
            169.178.222.46
            		unknownUnited States
            		37611AfrihostZAfalse
            109.129.79.187
            		unknownBelgium
            		5432PROXIMUS-ISP-ASBEfalse
            83.13.177.41
            		unknownPoland
            		5617TPNETPLfalse
            253.113.190.193
            		unknownReserved
            		unknownunknownfalse
            40.132.109.158
            		unknownUnited States
            		7029WINDSTREAMUSfalse
            146.39.178.162
            		unknownUnited States
            		197938TRAVIANGAMESDEfalse
            184.38.86.27
            		unknownUnited States
            		5778CENTURYLINK-LEGACY-EMBARQ-RCMTUSfalse
            99.223.182.92
            		unknownCanada
            		812ROGERS-COMMUNICATIONSCAfalse
            41.179.108.50
            		unknownEgypt
            		24863LINKdotNET-ASEGfalse
            62.135.4.212
            		unknownEgypt
            		24863LINKdotNET-ASEGfalse
            249.239.255.162
            		unknownReserved
            		unknownunknownfalse
            179.228.187.230
            		unknownBrazil
            		27699TELEFONICABRASILSABRfalse
            85.134.195.246
            		unknownIreland
            		24751MULTIFI-ASFIfalse
            190.207.250.245
            		unknownVenezuela
            		8048CANTVServiciosVenezuelaVEfalse
            182.116.28.224
            		unknownChina
            		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            251.134.38.124
            		unknownReserved
            		unknownunknownfalse
            9.254.40.126
            		unknownUnited States
            		3356LEVEL3USfalse
            120.195.48.62
            		unknownChina
            		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
            124.182.10.211
            		unknownAustralia
            		1221ASN-TELSTRATelstraCorporationLtdAUfalse
            93.140.61.197
            		unknownCroatia (LOCAL Name: Hrvatska)
            		5391T-HTCroatianTelecomIncHRfalse
            173.5.70.42
            		unknownUnited States
            		10507SPCSUSfalse
            86.172.120.247
            		unknownUnited Kingdom
            		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
            197.129.211.25
            		unknownMorocco
            		6713IAM-ASMAfalse
            46.153.18.240
            		unknownSaudi Arabia
            		35819MOBILY-ASEtihadEtisalatCompanyMobilySAfalse
            61.210.62.8
            		unknownJapan2510INFOWEBFUJITSULIMITEDJPfalse
            85.244.28.223
            		unknownPortugal
            		3243MEO-RESIDENCIALPTfalse
            152.237.114.197
            		unknownBrazil
            		7738TelemarNorteLesteSABRfalse
            251.172.40.214
            		unknownReserved
            		unknownunknownfalse
            205.201.209.63
            		unknownUnited States
            		6653FORETHOUGHTNETUSfalse
            68.254.240.31
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            77.121.20.57
            		unknownUkraine
            		25229VOLIA-ASUAfalse
            240.5.72.95
            		unknownReserved
            		unknownunknownfalse
            184.225.78.253
            		unknownUnited States
            		10507SPCSUSfalse
            147.202.174.64
            		unknownUnited States
            		19149TEAMTECH-DSMUSfalse

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
            Entropy (8bit):6.326713846296607
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:H9NSZqE1YV
            File size:87104
            MD5:58836131abfd4884cee3a45e82344236
            SHA1:99834e69d8788d276f63ee5968256cb84d3dc1c4
            SHA256:75197b35b16d2668bf3c9437ac9e29f2287db5b1f0839acc4f6dbcf7bca02ae2
            SHA512:1be5bcee9ef566a1300adf0e16d464dfd605ce09dc05a828733477c01370d8c261ef9beaffec24ba270cd68bba8f1cbb47c564fb50701a337d2e1bf45ad2f012
            SSDEEP:1536:npY0t1K/BFgpPidJ+bWxGcRy1A8dF67dGhY8CpSw5NJYPpo:oBFaPidI58mFtYZSubgpo
            TLSH:CC835C02B318094BF5E61DF0393F1BE193AFE98020F0B6C9690EE7499276E725546FD9
            File Content Preview:.ELF...........................4..R`.....4. ...(......................J...J...............J...J...J.......3 ........dt.Q.............................!..|......$H...H.(5...$8!. |...N.. .!..|.......?.........R...../...@..\?.....K..+../...A..$8...})....K.N..

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, big endian
            Version:1 (current)
            Machine:PowerPC
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x100001f0
            Flags:0x0
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:86624
            Section Header Size:40
            Number of Section Headers:12
            Header String Table Index:11

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x100000940x940x240x00x6AX004
            .textPROGBITS0x100000b80xb80x1288c0x00x6AX004
            .finiPROGBITS0x100129440x129440x200x00x6AX004
            .rodataPROGBITS0x100129680x129680x21900x00x2A008
            .ctorsPROGBITS0x10024afc0x14afc0x80x00x3WA004
            .dtorsPROGBITS0x10024b040x14b040x80x00x3WA004
            .dataPROGBITS0x10024b100x14b100x6b80x00x3WA008
            .sdataPROGBITS0x100251c80x151c80x4c0x00x3WA004
            .sbssNOBITS0x100252140x152140x900x00x3WA004
            .bssNOBITS0x100252a40x152140x2b780x00x3WA004
            .shstrtabSTRTAB0x00x152140x4b0x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x100000000x100000000x14af80x14af86.35160x5R E0x10000.init .text .fini .rodata
            LOAD0x14afc0x10024afc0x10024afc0x7180x33204.49340x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
            GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Aug 6, 2022 07:40:59.193033934 CEST754749684189.236.48.74192.168.2.23
            Aug 6, 2022 07:40:59.193345070 CEST496847547192.168.2.23189.236.48.74
            Aug 6, 2022 07:40:59.400290966 CEST754733416112.170.93.137192.168.2.23
            Aug 6, 2022 07:40:59.400446892 CEST334167547192.168.2.23112.170.93.137
            Aug 6, 2022 07:41:00.162621975 CEST42836443192.168.2.2391.189.91.43
            Aug 6, 2022 07:41:00.196702003 CEST754749716189.236.48.74192.168.2.23
            Aug 6, 2022 07:41:00.196880102 CEST497167547192.168.2.23189.236.48.74
            Aug 6, 2022 07:41:00.930406094 CEST4251680192.168.2.23109.202.202.202
            Aug 6, 2022 07:41:01.099153042 CEST1982923192.168.2.23158.209.73.34
            Aug 6, 2022 07:41:01.099175930 CEST1982923192.168.2.2379.230.189.239
            Aug 6, 2022 07:41:01.099219084 CEST1982923192.168.2.2340.71.205.34
            Aug 6, 2022 07:41:01.099277020 CEST1982923192.168.2.23255.240.206.49
            Aug 6, 2022 07:41:01.099286079 CEST1982923192.168.2.23146.74.47.18
            Aug 6, 2022 07:41:01.099335909 CEST1982923192.168.2.2378.218.165.73
            Aug 6, 2022 07:41:01.099375963 CEST1982923192.168.2.23244.16.155.19
            Aug 6, 2022 07:41:01.099416971 CEST1982923192.168.2.23129.8.7.47
            Aug 6, 2022 07:41:01.099425077 CEST1982923192.168.2.23216.253.109.206
            Aug 6, 2022 07:41:01.099432945 CEST1982923192.168.2.2344.139.232.96
            Aug 6, 2022 07:41:01.099443913 CEST1982923192.168.2.2323.21.46.22
            Aug 6, 2022 07:41:01.099562883 CEST1982923192.168.2.23191.197.164.163
            Aug 6, 2022 07:41:01.099611998 CEST1982923192.168.2.23126.178.56.153
            Aug 6, 2022 07:41:01.099622011 CEST1982923192.168.2.23117.53.114.23
            Aug 6, 2022 07:41:01.099623919 CEST1982923192.168.2.23173.7.147.254
            Aug 6, 2022 07:41:01.100465059 CEST1982923192.168.2.23170.51.199.30
            Aug 6, 2022 07:41:01.103271008 CEST1982923192.168.2.23206.243.187.98
            Aug 6, 2022 07:41:01.103282928 CEST1982923192.168.2.239.38.164.129
            Aug 6, 2022 07:41:01.103316069 CEST1982923192.168.2.2375.86.70.161
            Aug 6, 2022 07:41:01.103393078 CEST1982923192.168.2.2357.243.157.111
            Aug 6, 2022 07:41:01.103558064 CEST1982923192.168.2.2331.205.83.49
            Aug 6, 2022 07:41:01.103588104 CEST1982923192.168.2.23142.105.20.237
            Aug 6, 2022 07:41:01.103605986 CEST1982923192.168.2.2312.120.176.124
            Aug 6, 2022 07:41:01.103615046 CEST1982923192.168.2.2379.49.199.46
            Aug 6, 2022 07:41:01.103622913 CEST1982923192.168.2.2359.62.201.167
            Aug 6, 2022 07:41:01.103622913 CEST1982923192.168.2.23246.239.56.178
            Aug 6, 2022 07:41:01.103648901 CEST1982923192.168.2.2317.240.180.52
            Aug 6, 2022 07:41:01.103651047 CEST1982923192.168.2.23155.58.10.138
            Aug 6, 2022 07:41:01.103686094 CEST1982923192.168.2.23206.46.174.77
            Aug 6, 2022 07:41:01.103693008 CEST1982923192.168.2.2392.35.25.14
            Aug 6, 2022 07:41:01.103718042 CEST1982923192.168.2.23155.65.48.135
            Aug 6, 2022 07:41:01.103743076 CEST1982923192.168.2.239.152.178.21
            Aug 6, 2022 07:41:01.103754997 CEST1982923192.168.2.2318.32.189.2
            Aug 6, 2022 07:41:01.103779078 CEST1982923192.168.2.23192.8.195.30
            Aug 6, 2022 07:41:01.103782892 CEST1982923192.168.2.23242.39.196.246
            Aug 6, 2022 07:41:01.103799105 CEST1982923192.168.2.23126.101.119.208
            Aug 6, 2022 07:41:01.103804111 CEST1982923192.168.2.23154.238.65.57
            Aug 6, 2022 07:41:01.103823900 CEST1982923192.168.2.23250.83.50.223
            Aug 6, 2022 07:41:01.103841066 CEST1982923192.168.2.23141.191.30.241
            Aug 6, 2022 07:41:01.103854895 CEST1982923192.168.2.23177.61.206.106
            Aug 6, 2022 07:41:01.103871107 CEST1982923192.168.2.23126.231.7.36
            Aug 6, 2022 07:41:01.103890896 CEST1982923192.168.2.23222.21.186.251
            Aug 6, 2022 07:41:01.103923082 CEST1982923192.168.2.23166.252.138.130
            Aug 6, 2022 07:41:01.103928089 CEST1982923192.168.2.2398.238.12.183
            Aug 6, 2022 07:41:01.103962898 CEST1982923192.168.2.2395.108.120.160
            Aug 6, 2022 07:41:01.103971004 CEST1982923192.168.2.23240.255.179.116
            Aug 6, 2022 07:41:01.103979111 CEST1982923192.168.2.23249.120.204.216
            Aug 6, 2022 07:41:01.104021072 CEST1982923192.168.2.2341.138.204.216
            Aug 6, 2022 07:41:01.104024887 CEST1982923192.168.2.2375.107.174.19
            Aug 6, 2022 07:41:01.104043961 CEST1982923192.168.2.23189.91.61.212
            Aug 6, 2022 07:41:01.104046106 CEST1982923192.168.2.23115.73.228.45
            Aug 6, 2022 07:41:01.104048014 CEST1982923192.168.2.2382.191.215.119
            Aug 6, 2022 07:41:01.104063034 CEST1982923192.168.2.23184.159.13.165
            Aug 6, 2022 07:41:01.104074001 CEST1982923192.168.2.23126.190.15.28
            Aug 6, 2022 07:41:01.104077101 CEST1982923192.168.2.23248.223.149.35
            Aug 6, 2022 07:41:01.104110956 CEST1982923192.168.2.234.206.204.188
            Aug 6, 2022 07:41:01.104110956 CEST1982923192.168.2.23133.39.93.48
            Aug 6, 2022 07:41:01.106878996 CEST1982923192.168.2.23177.48.146.134
            Aug 6, 2022 07:41:01.106899023 CEST1982923192.168.2.23123.82.105.240
            Aug 6, 2022 07:41:01.106916904 CEST1982923192.168.2.23177.100.147.184
            Aug 6, 2022 07:41:01.106966972 CEST1982923192.168.2.23221.183.42.104
            Aug 6, 2022 07:41:01.106976032 CEST1982923192.168.2.23100.239.35.51
            Aug 6, 2022 07:41:01.106993914 CEST1982923192.168.2.23109.109.217.148
            Aug 6, 2022 07:41:01.107219934 CEST1982923192.168.2.23147.46.7.29
            Aug 6, 2022 07:41:01.107238054 CEST1982923192.168.2.2319.182.69.252
            Aug 6, 2022 07:41:01.107261896 CEST1982923192.168.2.23175.179.188.108
            Aug 6, 2022 07:41:01.107264996 CEST1982923192.168.2.23197.64.15.194
            Aug 6, 2022 07:41:01.107275963 CEST1982923192.168.2.23244.76.15.159
            Aug 6, 2022 07:41:01.107322931 CEST1982923192.168.2.23157.40.84.172
            Aug 6, 2022 07:41:01.107327938 CEST1982923192.168.2.2346.139.16.91
            Aug 6, 2022 07:41:01.107405901 CEST1982923192.168.2.23162.123.0.149
            Aug 6, 2022 07:41:01.107409954 CEST1982923192.168.2.23146.198.116.26
            Aug 6, 2022 07:41:01.107414961 CEST1982923192.168.2.23187.147.126.255
            Aug 6, 2022 07:41:01.107422113 CEST1982923192.168.2.2339.186.101.110
            Aug 6, 2022 07:41:01.107425928 CEST1982923192.168.2.231.81.93.150
            Aug 6, 2022 07:41:01.107429028 CEST1982923192.168.2.2373.1.136.94
            Aug 6, 2022 07:41:01.107436895 CEST1982923192.168.2.2399.169.154.28
            Aug 6, 2022 07:41:01.107446909 CEST1982923192.168.2.23246.223.99.7
            Aug 6, 2022 07:41:01.107456923 CEST1982923192.168.2.23115.78.215.149
            Aug 6, 2022 07:41:01.107459068 CEST1982923192.168.2.23122.5.67.205
            Aug 6, 2022 07:41:01.107459068 CEST1982923192.168.2.23240.59.195.253
            Aug 6, 2022 07:41:01.107470989 CEST1982923192.168.2.23217.240.213.92
            Aug 6, 2022 07:41:01.107475042 CEST1982923192.168.2.2373.36.212.140
            Aug 6, 2022 07:41:01.107496023 CEST1982923192.168.2.23190.79.228.144
            Aug 6, 2022 07:41:01.107532024 CEST1982923192.168.2.23186.255.243.188
            Aug 6, 2022 07:41:01.107553959 CEST1982923192.168.2.2354.106.117.18
            Aug 6, 2022 07:41:01.107580900 CEST1982923192.168.2.23174.208.184.140
            Aug 6, 2022 07:41:01.107646942 CEST1982923192.168.2.2366.10.68.68
            Aug 6, 2022 07:41:01.107686043 CEST1982923192.168.2.23164.119.22.171
            Aug 6, 2022 07:41:01.107686996 CEST1982923192.168.2.23211.18.200.93
            Aug 6, 2022 07:41:01.107700109 CEST1982923192.168.2.2365.101.227.169
            Aug 6, 2022 07:41:01.107712030 CEST1982923192.168.2.23252.191.215.253

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
            Aug 6, 2022 07:41:01.116614103 CEST192.168.2.238.8.8.80xdb08Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:09.165544033 CEST192.168.2.238.8.8.80xbb1eStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:12.213207960 CEST192.168.2.238.8.8.80xe192Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:21.259176970 CEST192.168.2.238.8.8.80x770fStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:25.307424068 CEST192.168.2.238.8.8.80xf37bStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:32.422629118 CEST192.168.2.238.8.8.80x5c25Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:41.507055998 CEST192.168.2.238.8.8.80xc3ebStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:50.554505110 CEST192.168.2.238.8.8.80xe50dStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:41:52.602288961 CEST192.168.2.238.8.8.80xdb3fStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:01.654665947 CEST192.168.2.238.8.8.80x3446Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:09.704438925 CEST192.168.2.238.8.8.80xacc5Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:11.751385927 CEST192.168.2.238.8.8.80x38cdStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:17.802405119 CEST192.168.2.238.8.8.80x8340Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:20.852332115 CEST192.168.2.238.8.8.80xc617Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:28.902182102 CEST192.168.2.238.8.8.80xc2a8Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:33.952630997 CEST192.168.2.238.8.8.80x2d8bStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:41.004432917 CEST192.168.2.238.8.8.80x6751Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:47.074788094 CEST192.168.2.238.8.8.80x4c77Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:42:56.123281002 CEST192.168.2.238.8.8.80xe9cbStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:04.171331882 CEST192.168.2.238.8.8.80x8817Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:11.220374107 CEST192.168.2.238.8.8.80x72c2Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:12.270960093 CEST192.168.2.238.8.8.80xf4e5Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:22.319828987 CEST192.168.2.238.8.8.80xa83dStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:26.370374918 CEST192.168.2.238.8.8.80xb9aeStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:36.420439959 CEST192.168.2.238.8.8.80x9b73Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:42.501266003 CEST192.168.2.238.8.8.80xfffaStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:48.786597013 CEST192.168.2.238.8.8.80xdb08Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:51.552239895 CEST192.168.2.238.8.8.80xc97aStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:54.600958109 CEST192.168.2.238.8.8.80x91c0Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:56.834305048 CEST192.168.2.238.8.8.80xbb1eStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:43:59.882426023 CEST192.168.2.238.8.8.80xe192Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:03.662785053 CEST192.168.2.238.8.8.80xbc06Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:04.711616039 CEST192.168.2.238.8.8.80xabc1Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:08.928091049 CEST192.168.2.238.8.8.80x770fStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:13.022116899 CEST192.168.2.238.8.8.80xf37bStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:14.806247950 CEST192.168.2.238.8.8.80xd163Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:15.852396965 CEST192.168.2.238.8.8.80x4dfcStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:17.901329041 CEST192.168.2.238.8.8.80x4e79Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:20.114877939 CEST192.168.2.238.8.8.80x5c25Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:27.949146986 CEST192.168.2.238.8.8.80xb943Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:28.997534037 CEST192.168.2.238.8.8.80xee1bStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:44:29.172676086 CEST192.168.2.238.8.8.80xc3ebStandard query (0)arcticboatz.czA (IP address)IN (0x0001)

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
            Aug 6, 2022 07:41:01.135778904 CEST8.8.8.8192.168.2.230xdb08No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:09.183168888 CEST8.8.8.8192.168.2.230xbb1eNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:12.230926037 CEST8.8.8.8192.168.2.230xe192No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:21.278891087 CEST8.8.8.8192.168.2.230x770fNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:25.325009108 CEST8.8.8.8192.168.2.230xf37bNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:32.442219019 CEST8.8.8.8192.168.2.230x5c25No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:41.524699926 CEST8.8.8.8192.168.2.230xc3ebNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:50.571964979 CEST8.8.8.8192.168.2.230xe50dNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:41:52.621741056 CEST8.8.8.8192.168.2.230xdb3fNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:01.674204111 CEST8.8.8.8192.168.2.230x3446No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:09.722086906 CEST8.8.8.8192.168.2.230xacc5No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:11.770395041 CEST8.8.8.8192.168.2.230x38cdNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:17.821860075 CEST8.8.8.8192.168.2.230x8340No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:20.871762037 CEST8.8.8.8192.168.2.230xc617No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:28.921660900 CEST8.8.8.8192.168.2.230xc2a8No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:33.972543001 CEST8.8.8.8192.168.2.230x2d8bNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:41.024063110 CEST8.8.8.8192.168.2.230x6751No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:47.094512939 CEST8.8.8.8192.168.2.230x4c77No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:42:56.140731096 CEST8.8.8.8192.168.2.230xe9cbNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:04.190247059 CEST8.8.8.8192.168.2.230x8817No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:11.240196943 CEST8.8.8.8192.168.2.230x72c2No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:12.290678978 CEST8.8.8.8192.168.2.230xf4e5No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:22.339315891 CEST8.8.8.8192.168.2.230xa83dNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:26.389827967 CEST8.8.8.8192.168.2.230xb9aeNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:36.472057104 CEST8.8.8.8192.168.2.230x9b73No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:42.520622969 CEST8.8.8.8192.168.2.230xfffaNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:48.804306030 CEST8.8.8.8192.168.2.230xdb08No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:51.571899891 CEST8.8.8.8192.168.2.230xc97aNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:54.620553970 CEST8.8.8.8192.168.2.230x91c0No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:56.853245020 CEST8.8.8.8192.168.2.230xbb1eNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:43:59.899748087 CEST8.8.8.8192.168.2.230xe192No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:03.682626963 CEST8.8.8.8192.168.2.230xbc06No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:04.731012106 CEST8.8.8.8192.168.2.230xabc1No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:08.947515965 CEST8.8.8.8192.168.2.230x770fNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:13.041237116 CEST8.8.8.8192.168.2.230xf37bNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:14.823204994 CEST8.8.8.8192.168.2.230xd163No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:15.871874094 CEST8.8.8.8192.168.2.230x4dfcNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:17.920802116 CEST8.8.8.8192.168.2.230x4e79No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:20.132091045 CEST8.8.8.8192.168.2.230x5c25No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:27.968497038 CEST8.8.8.8192.168.2.230xb943No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:29.015249014 CEST8.8.8.8192.168.2.230xee1bNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:44:29.192786932 CEST8.8.8.8192.168.2.230xc3ebNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)

            System Behavior

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:/tmp/H9NSZqE1YV
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:43:48
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6

            General

            Start time:07:41:00
            Start date:06/08/2022
            Path:/tmp/H9NSZqE1YV
            Arguments:n/a
            File size:5388968 bytes
            MD5 hash:ae65271c943d3451b7f026d1fadccea6